screen-coin[.]xyz

Analysis of screen-coin.xyz, created on December 17, 2025, shows a set of infrastructure indicators that align with typical phishing deployments. The domain resolves to the Cloudflare address 104.21.66.159, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. Both authoritative nameservers, ariadne.ns.cloudflare.com and ignacio.ns.cloudflare.com, are Cloudflare‑managed, a pattern often used to hide the true hosting environment of malicious actors. The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com, a service known for low‑cost registrations, and no SSL certificate is present, leaving the site without encrypted transport.

VirusTotal reports that three out of ninety‑three scanning vendors flagged the domain, indicating that at least a subset of security products have identified suspicious characteristics. The domain is also listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the classification as a phishing resource. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, further confirming a high‑risk assessment. The page title returned from the site is "Web Development Studio," which does not correspond to any known legitimate brand and is likely a generic placeholder used to obscure the malicious intent.

Current operational status is offline; the domain has been taken down, but the historical evidence remains relevant for defenders. Uncertainties include the exact payload or credential‑harvesting mechanisms that may have been hosted while the site was active, as no content analysis or HTTP response details are available. Defenders should continue to block the domain at network perimeters, add it to URL filtering and threat‑intel feeds, and monitor the associated IP address for any re‑use in future campaigns.